ApostropheCMS: Authenticated Object-Level Authorization Bypass In Exist-in-locale Reveals Restricted Localized Draft Ide

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorizati...

PT-2026-120324

Summary ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mode, including draft mode. The endpoint returns localized document identifiers without applying document-level view or edit authorizati...

Use of Cache Containing Sensitive Information

Overview next is a react framework. Affected versions of this package are vulnerable to Use of Cache Containing Sensitive Information via cross-request deduplication in the 'use cache' mechanism, where draft mode state is not accounted for when sharing cached fills between concurrent requests. A...

Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...

GHSA-3W37-WQ28-93X7 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Pending use cache fills are shared across requests for the same key without distinguishing Draft Mode requests from regular requests. When two such requests overlap, the second request receives the first request's fill: - A regular request that overlaps an editor's Draft Mode request receives...

NPM: Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

NPM: Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages vulnerability discovered by ? in WordPress Npm next versions = 16.3.0, 16.3.8...

EUVD-2026-91668

Next.js: Pending use cache fill can leak Draft Mode content into regular responses and persisted pages...

CVE-2026-94544

A flaw was found in Next.js. Pending cache operations do not properly separate Draft Mode requests from standard requests when fulfilling matching cache keys. Under concurrent request conditions, an unauthenticated user can receive unpublished draft content generated during an editor's session. I...

CVE-2026-94544

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544 Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

CVE-2026-94544

The Next.js React framework (versions 16.3.0 through 16.3.8 ) contains a flaw where pending use cache fills for the same key do not properly separate Draft Mode requests from regular requests. Under concurrent request conditions, this lack of separation allows an unauthenticated user to receive u...

PT-2026-104380

Name of the Vulnerable Software and Affected Versions Next.js versions 16.3.0 through 16.3.7 Description Pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. This allows an overlapping regular request to receive unauthenticated...

CVE-2026-94544: Use of Cache Containing Sensitive Information

Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without separating Draft Mode requests from regular requests. An overlapping regular request can receive unauthenticated unpublished content from an...

Linux Distros Unpatched Vulnerability : CVE-2026-94544

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Next.js is a React framework for building full-stack web applications. From 16.3.0 until 16.3.8, pending use cache fills for the same key are shared without...

EUVD-2010-5053

Malware in sbrugna...

CVE-2010-5089

SilverStripe before 2.4.2 does not properly restrict access to pages in draft mode, which allows remote attackers to obtain sensitive information...

SUSE CVE-2013-5645

Multiple cross-site scripting XSS vulnerabilities in Roundcube webmail before 0.9.3 allow user-assisted remote attackers to inject arbitrary web script or HTML via the body of a message visited in 1 new or 2 draft mode, related to compose.inc; and 3 might allow remote authenticated users to injec...